CVE-2026-114120 SchedulePress before 5.3.5 Missing Authorization via wpsp_el_editor_form AJAX Action

Medium 5.3 Published 21 Oct 2026 Updated 21 Oct 2026

Exploited in the wild: Not known
Fix: None listed

What is CVE-2026-114120?

CVE-2026-114120 is a medium-severity vulnerability in WPDeveloper SchedulePress, published on 21 Oct 2026.

Official description

SchedulePress before 5.3.5 contains a missing authorization vulnerability that allows authenticated Contributor-level users to change any post's status and publish date via the wpsp_el_editor_form AJAX action. Attackers can reuse the wpsp-el-editor nonce from the Elementor modal to unpublish or reschedule administrator posts, or publish other users' pending or draft posts.

Weakness: CWE-862

Which versions are affected by CVE-2026-114120?

How do I fix CVE-2026-114120?

No fix has been published for CVE-2026-114120 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-114120 being exploited?

There is no known exploitation of CVE-2026-114120 in the wild and no public exploit code.

Sources

Also known as GHSA-wjcc-2q8h-xjfx.